CVE-2025-41443: Guest user can discover active public channels
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/{teamid}/channels/ids endpoint
Other sources
Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the /api/v4/teams/{teamid}/channels/ids endpoint
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.11.3 - Upgrade
Upgrade
go/github.com/mattermost/mattermost-serverto a version that resolves this vulnerability.Fixed in 10.5.11 - Upgrade
Upgrade
go/github.com/mattermost/mattermost/server/v8to a version that resolves this vulnerability.Fixed in 8.0.0-20250822090405-e8c7e7d0252b - Upgrade
Upgrade
Mattermostto a version that resolves this vulnerability.Fixed in 10.12.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41443?
CVE-2025-41443 has a medium severity rating due to the potential exposure of channel information to unauthorized guest users.
How do I fix CVE-2025-41443?
To fix CVE-2025-41443, upgrade Mattermost to versions later than 10.5.10 or 10.11.2.
What are the affected versions in CVE-2025-41443?
CVE-2025-41443 affects Mattermost versions 10.5.x up to and including 10.5.10 and 10.11.x up to and including 10.11.2.
What impact does CVE-2025-41443 have on Mattermost?
CVE-2025-41443 allows guest users to access metadata of public channels, potentially exposing sensitive team information.
Is there a workaround for CVE-2025-41443?
There are no official workarounds for CVE-2025-41443; the recommended solution is to update to a secure version.